CVE-2026-14021: Chrome StorageAccessAPI Cross-Origin Data Leak (CVSS 6.5)

Technical summary

CVE-2026-14021 is a cross-origin data leak vulnerability stemming from insufficient policy enforcement within Chrome's StorageAccessAPI. An attacker controlling the renderer process can craft an HTML page that bypasses the intended origin isolation boundaries, enabling unauthorized access to data from different origins. The vulnerability is classified under CWE-20 (Improper Input Validation), indicating a gap in enforcement of the Storage Access API's security model. Exploitation requires user interaction with the malicious page, as reflected in the CVSS vector (UI:R), and is limited in scope to confidentiality impacts (C:H) with no integrity or availability effects.

Business impact

Organizations relying on Chrome should prioritize patching to prevent potential leakage of sensitive cross-origin data to attackers with renderer-level access. This is particularly relevant for enterprises handling financial data, authentication tokens, or other sensitive information stored in browser storage. While the renderer must be compromised first—a significant barrier—the subsequent cross-origin leakage could amplify the blast radius of an initial compromise. User education around phishing and malware distribution remains critical, as it directly prevents the renderer compromise prerequisite.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all Chrome installations on Windows, macOS, Linux, Android, and iOS that have not been updated to the patched version. Enterprise users managing Chrome deployments via Google Admin Console or third-party MDM solutions should verify their fleet's update status.

Exploitability

Exploitation requires two conditions: (1) prior compromise of the Chrome renderer process, typically via malware, drive-by download, or a separate exploit, and (2) user interaction with a crafted HTML page served by the attacker. While renderer compromise is non-trivial, it is not unprecedented in real-world attack chains. Once the renderer is compromised, the attack itself is straightforward. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited evidence of active weaponization in the wild at publication.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. For managed environments, deploy updates via Google Admin Console (for enterprise Chrome) or your MDM platform. Enable automatic updates to ensure continuous protection. In addition, implement application whitelisting, keep operating systems patched, and maintain robust endpoint detection and response (EDR) capabilities to reduce the likelihood of renderer process compromise in the first place.

Patch guidance

Update Chrome to 150.0.7871.47 or later. Users with automatic updates enabled will receive the patch automatically; manual updates can be triggered via Menu > Settings > About Chrome > Check for updates. For enterprise deployments, verify patch rollout via Google Admin Console and confirm version compliance across your fleet within 7–14 days. Organizations with Chrome Management policies should enforce automatic updates to prevent delayed patching.

Detection guidance

Monitor for unusual Chrome renderer process behavior or crashes, which may indicate exploitation attempts. Review browser cache and local storage for unexpected cross-origin data access patterns. Web security gateways and HTTP proxy logs should flag requests to crafted HTML pages from external sources. Endpoint detection tools should correlate renderer crashes or anomalous memory access with user interactions on untrusted sites. Forensic analysis post-compromise should examine Chrome's Local Storage and IndexedDB contents for signs of unauthorized cross-origin access.

Why prioritize this

While the CVSS score of 6.5 is moderate, the vulnerability combines a known security model (origin isolation) with insufficient enforcement. The prerequisite of renderer compromise is a significant but not insurmountable barrier, and cross-origin data leakage can dramatically amplify an attacker's capabilities. Organizations should prioritize this update alongside other critical patches, but it does not require emergency response if endpoint protections are strong. The absence from KEV indicates lower real-world exploitation pressure at this time, allowing a standard 7–14 day patching window.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects high confidentiality impact (C:H), no integrity or availability impact, network-accessible attack vector (AV:N), low complexity (AC:L), and required user interaction (UI:R). The score appropriately captures the cross-origin data leakage risk while acknowledging the prerequisite of prior renderer compromise. Organizations with strong endpoint security postures may tolerate slightly longer patching timelines; those in sensitive sectors should accelerate patching to mitigate amplified data leak scenarios.

Frequently asked questions